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Abstract — We show that polar codes asymptotically achieve 
the whole capacity-equivocation region for the wiretap channel 
when the wiretapper's channel is degraded with respect to the 
main channel, and the weak secrecy notion is used. Our coding 
scheme also achieves the capacity of the physically degraded 
receiver-orthogonal relay channel. We show simulation results for 
moderate block length for the binary erasure wiretap channel, 
comparing polar codes and two edge type LDPC codes. 

I. Introduction 

Polar codes were introduced by Arikan and were shown 
to be capacity achieving for a large class of channels (TJ. 
Polar codes are block codes of length N = 2™ with binary 
input alphabet X. Let G = RF® n , where R is the bit-reversal 
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mapping defined in (TJ, F 
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and F® n denotes the 



We define the nested polar code P(N, A, B) of length N 
where B C A as follows. The codewords of P(N, A, B) 
are the same as the codewords for P(N,A). The nested 
structure is defined by partitioning P(N, A) as cosets of 
P(N, B). Thus codewords in P(N, A, B) are given by x — 
ubGb © ua\bGa\b, where w.a\b determines which coset the 
codeword lies in. Note that each coset will be a polar code 
with B c as the frozen set. The frozen bits u, are either (if 
i G A c ) or they equal the corresponding bits in u^\k. 

Let W and W be two symmetric binary input memoryless 
channels. Let W be degraded with repect to W. Denote the 
polarized channels as defined in (fl3 by W$ (resp. W$), and 

(i) ~ (i) 

their Bhattacharyya parameters by Z N (resp. Z N ). We will 
use the following Lemma which is Lemma 4.7 from 0: 



Kronecker power of F. Apply the linear transformation G Lemma 1.1. // W is degraded with respect to W then W 



to N bits {ui]f =1 and send the result through N independent 
copies of a binary input memoryless channel W(y\x). This 
gives an A-dimensional channel Wn{Ui\ui), and Arikan's 
observation was that the channels seen by individual bits, 
defined by 
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T W0v(l/f|«f), (1) 



polarize, i.e as N grows WV approaches either an error-free 
channel or a completely noisy channel. 

We define the polar code P(N, A) of length N as follows. 
Given a subset A of the bits, set m = for i G A c . We 
call A c the frozen set, and the bits {ui} if z A c frozen bits. 
The codewords are given by x N = u^Ga, where Gj. is the 
submatrix of G formed by rows with indices in A. The rate 
of P(N,A) is \A\/N. 

The block error probability using the successive cancellation 
(SC) decoding rule defined by 



(i) ~ (i) (i) 

is degraded with respect to W N and Z N > Z N . 

In Sections HI] and Hn] we use Lemma IlTI to show that nested 
polar codes are capacity achieving for the degraded wiretap 
channel and the physically degraded relay channel. 

To our knowledge this worlqj is the first to consider polar 
codes for the (degraded) relay channel. Independent recent 
work concerning the wiretap channel includes [4| and |5|. 
II. Nested Polar Wiretap Codes 

We consider the wiretap channel introduced by Wyner ||6j. 
The sender, Alice, wants to transmit a message S chosen uni- 
formly at random from the set S to the intended receiver, Bob, 
while trying to keep the message secure from a wiretapper, 
Eve. We assume that the input alphabet X is binary, and Bob's 
output alphabets y and Eve's output alphabet Z are discrete. 
We assume that the main channel (given by Py\x) ar, d the 
wiretapper's channel (given by Pz\x) 316 symmetric. We also 
assume that Pz\x is stochastically degraded with respect to 
Py\x, i-e. there exists a probability distribution Pz\y such 
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> 1 when i G A that p z\x(z\x) = J2 y ey p z\Y(z\y)P Y \x(y\3 



1 otherwise 



can be upper bounded by J2ieA^ < N' where Z$ is the 
Bhattacharyya parameter for the channel Wff JT]. It was 
shown in |2| that for any (3 < 1/2, 
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liminf -^\{i:Z$ < 2 



}\ = i(w), 
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where I(W) is the symmetric capacity of W, which equals 
the Shannon capacity for symmetric channels. Thus if we let 
A N = {i : Z$ < 2- Nli }, the rate of P(N,A N ) approaches 
I(W) as N grows. Also the block error probability P e using 
SC decoding is upper bounded by 



A codebook with block length N for the wiretap channel is 
given by a set of disjoint subcodes {C(s) C X N } s< zs, where 
S is the set of possible messages. To encode the message 
s G S, Alice chooses one of the codewords in C(S) uniformly 
at random and transmits it. Bob uses a decoder <fi : 3^ — > S 
to determine which message was sent. 

A rate-equivocation pair (R,R e ) is said to be achievable if 
Ve > and for a sufficiently large N, there exists a message 
set S, subcodes {C(s)} se s, and a decoder tj> such that 



i log \S\>R- e, 



P(<j>(Y N ) ^S)<e, 
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W(S\Z") >R e -e, 
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where M(S\Z N ) denotes the conditional entropy of S given 
Z N . The set of achievable pairs (R, R e ) for this setting is 



R P <R<C 
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< R e <C 



M 



c 



ir. 



(6) 



where Cm is the capacity of the main channel, and Cw is the 
capacity of the wiretapper's channel Q. 

In Theorem III. II we give a nested polar coding scheme 
[8 1 for the wiretap channel that achieves the whole rate- 
equivocation rate region. Let the wiretapper's channel be 
denoted by W and the main channel by W . We assume that 
W and W are symmetric, so Cm — I(W) an< ^ — I{W). 

Theorem HI. Let (R,R e ) satisfy ©. For all e > there 
exists a nested polar code of length N = 2™ that satisfies (0 
and provided n is large enough. 



Proof: Let (3 < 1/2, A N = {i 



J N 



< 2 



and let Bn be the subset of An of size N(Cm 

0) 



}. 

R) 



whose members have the smallest Zx, . Since (fj) implies 
liminfn^oo \An\/N — Cm > Cm — R such a subset exists 
if n is large enough. This defines our nested polar code 
P(N, An , Bn), and the subcodes C(sjv) are the cosets of 
P(N,B N ). 

To send the message sn, Alice generates the codeword 



X N — T n Gb n © snGa n \b N i 



(7) 



where Tn is a binary vector of length N(Cm — R) chosen 
uniformly at random. 

From (0 the block error probability for Bob goes to zero 
as n goes to infinity. The rate of the coding scheme is 
j]\An\Bn\, which goes to Cm — {Cm — R) = R as n goes 
to infinity, since lim inf n -Hx \ An\/N = Cm- Thus our coding 
scheme satisfies ©. 

To show <(5j we look at the equivocation for Eve. We 
first look at the case where R > Cm — Cw- We expand 
I(X , Sn', Z ) in two different ways and obtain 

I(X N , S N ; Z N ) = I{X N : Z N ) + I(S N ; Z N \X N ) 

= I{S N ;Z N )+I{X N -Z N \S N ). (8) 



Note that I(S N ; Z N \X N ) = as S N -> X N ->• is a 
Markov chain. By © and noting I(S N ;Z N ) = U(S N ) - 
U(S N \Z N ), we write the equivocation rate M{S N \Z N )/N as 

W(S N ) + I(X N : Z N \S N ) - I(X N ; Z N ) _ M(S N ) 

=R-S(N) 

M(X N \S N ) M(X N \Z N ,S N ) I{X N ;Z N ) 
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> Cm -C w - 6(N) 



W(X N \Z N ,S N ) 
N 



where 8(N) is the difference between \An \ Bn\/N and R 
which goes to zero as n —> oo. 



We now look at W(X N \Z N , S N ). For a fixed 5 



s N 



we see that X N g C(sn)- Let P' e be the error probability 
of decoding this code using an SC decoder. By Lemma HT1 
the set An = {i ■ Zj) < 2~ JV ' 3 } is a subset of An- Also, 



liminfn^oo ^|^4jv| = C w , so if \B N \ < NC W we have 
Bn C An for large n, by the definition of Bn- Since = 



N(C M - R) < NC W , we have Z$ < 2~ N " V« G B N for 



large enough n. This implies P' e < J2ieB N ^n' 



We use Fano's inequality to show that W(X N \Z N , S N ) -> 0: 
lim inf H^IZ^, S*at) < lim inf [H(P e ') + P e '|Bjv|] = 0. 



Thus we have shown that b ( Sn ^ z ) > (7 M _ (7^, _ e > R e — e 
for n large enough. 

We now consider the case when R < Cm — Cw- 
The only difference from the analysis above is the term 
W(X N \Z N ,S N ). Since \B N \ = N(C M - R) > NC W , 
the code defined by (0 is not decodable. Instead, let 
B 1N = {i ■ Z$ < 2- Nt< }, B 2N = B N \ Bin, and rewrite © 
as X N = TinGb 1n ®T 2 nGb 2N © SnG^ n \ Bn . 

Note that, since liminfu^oo \Bin\/N = Cw, this code is 
decodable using SC given T 2 n- If T 2 n is unknown we can try 
all possible combinations and come up with 2' 82JV I equally 
likely solutions (all solutions are equally likely since Tn is 
chosen uniformly at random). Thus M(X N \Z N , Sn) should 
tend to M(T 2 n)- We make this argument precise by bounding 
M(X N \Z N ,S N ) as follows: 

M(X N \Z N ,S N ) =U(X n ,T 2N \Z n ,Sn) 

= W(T 2N \Z N , S N ) + M(X N \Z N , S N , T 2N ) 
< H(T 2Ar ) + M(X N \Z N , S N , T 2N ) 

where in the last step we have used the fact that con- 
ditioning reduces entropy. We can show that the second 
term goes to zero using Fano's inequality as above. Since 

liminfn^oo H( ^ Jv) = lim inf 1%^ = C M - R - C w , 



we get M(S N \Z N )/N > R - e for n large enough. ■ 
In Section [ill] we show that the nested polar code scheme 
can be used to achieve capacity for the physically degraded 
receiver-orthogonal relay channel (PDRORC). 

III. Nested Polar Relay Channel Codes 

The PDRORC is a three node channel with a sender, a relay, 
and a destination Q- The sender wishes to convey a message 
to the destination with the aid of the relay. Let the input at the 
sender and the relay be denoted by X and X\ respectively, 
and let the corresponding alphabets X and X\ be binary. We 
denote the source to relay (SR) channel output by Y\, the 
source to destination (SD) channel output by Y', and the 
relay to destination (RD) channel output by Y". We assume 
that the corresponding output alphabets > y', and y" are 
discrete. The SR and SD channel transition probabilities are 
given by Py'Yilx and the RD channel transition probability 
is given by Py"\Xx- Note that the receiver components are 
orthogonal, i.e. PyyiXXi — Py'\xPy"\x x - We further 
assume that the SD channel is physically degraded with respect 
to the SR channel, i.e Py'y x \x — Py 1 \xPy , \y 1 , and that 
all the channels Py'\x> -FVi|X> and Py"\x x are symmetric. 
The capacity of the PDRORC channel is given by C = 
max Kl)p(ll) min {I(X; Y') + I(X i; Y"), I(X; Y', Y ± )}. In 
the symmetric physically degraded case this simplifies to 
C = mm{C SD + C rd ,C S r}, where C SD , C SR , and C RD 
are the capacities of the SD, SR, and RD channels respectively. 
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Theorem III.l. Let R < C. For all e > there exists a nested 
polar code of rate R and length [B + 1)N = (B + 1)2™ such 
that the error probability at the destination is smaller than e 
provided B and n are large enough. 

Proof: We use a block-Markov coding scheme and trans- 
mit B codewords of length N in B + 1 blocks. Let W and 

(i) 

W denote the SR and SD channels respectively. Let Z N and 
Zjy be the Bhattacharyya parameters of the corresponding 
polarized channels. 

First assume that Csr < Csd + Crd- Let f3 < 1/2, 
A N = {i: Z N ] < 2~ N "}, and let B N = {< : Z$ < 2"^}. 
By Lemma 11.11 Bn C -Ajv. The source will transmit in 
each block using the nested polar code P(N, An, Bn)- After 
receiving the whole codeword the relay decodes the bits in 
An. The probability that the relay makes an error when 
decoding can be made smaller than e/(3B) by choosing n 
large enough. The relay then reencodes the bits in An \Bn 
and transmits them using a polar code of rate (\An\ — \Bn\) /N 
in the next block. In general, in block k the source trans- 
mits the fc th codeword while the relay transmits the bits in 
An \ Bn from the (k — l) th block. The destination first 
decodes the bits in ,4^ \ Bn using the transmission from 
the relay. This can be done with error probability smaller 
than e/(3B) provided n is large enough since the rate of the 
relay to destination code tends to Csr — Csd < Crd as n 
grows. Finally the destination decodes the source transmission 
from the (fc — l) th block. It uses the bits from the relay 
transmission in block k to determine which coset of P(N, Bn) 
the codeword lies in. The rate of P(N, Bn) approaches Csd 
so the destination can decode with block error probability 
smaller than e/(3B). By the union bound the overall error 
probability over all B blocks is then smaller than e. The 
rate of the scheme is B\An\/X(B + 1) which can be made 
arbitrarily close to Csr provided B and n are large enough 
since liminL^oo \An\/N = Csr- 

Now assume that Csr > Csd + Crd- Let Bn = {i ■ 
Z^ ] < 2~ nP } and let A N be a subset of {i : Z^ < 2~ N? } 
of size N(Csd + Crd) containing Bn- Such a subset exists 
provided n is large enough since Csr > Csd + Crd- The 
analysis of the block error probability is the same as in the first 
case, and the rate of the coding scheme is B\An\/N(B + 1) 
which approaches Csd + Crd when n and B are large. ■ 

IV. Simulations 

We show simulation results comparing Eve's equivocation 
for nested polar wiretap codes and two edge type LDPC codes 
over a wiretap channel where both the main channel and the 
wiretapper's channel are binary erasure channels with erasure 
probabilities e m an d e w respectively. The LDPC codes are 
optimized using the methods in iflOl and for the LDPC codes 
the curve shows the ensemble average. The equivocation at 
Eve is calculated using an extension of a result in 1 1 1 0: 

Lemma IV. 1. Let H be a parity check matrix for the overall 
code (P(N, An) in the polar case) and let ifW be a parity 

2 Note that the polar codes P(N, -4jv) and P(N, Bn) are linear codes and 
we therefore can calculate the corresponding parity check matrices. 
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Fig. 1. Equivocation rate versus e w . Codes designed for R = 0.25, 
e m = 0.25, e w = 0.5, and block length N = 1024. 

check matrix for the subcode (P(N,Bn)) in a nested coding 
scheme for the binary erasure channel. Then the equivocation 
at Eve is rank(Hg ) — rank{Hg), where Hg is the matrix 
formed from the columns of H corresponding to erased 
codeword positions. 

Proof: The equivocation at Eve can be written as 

M(S N \Z N ) = W(X N \Z N ) - W(X N \S N , Z n ). (9) 

For a specific received z we have Hgx^+Hgcx^c = 0, where 
Xg is unknown. The above equation has 2 Ar_rank ( ff£ ) solutions, 
all of which are equally likely since the original codewords 
X N are equally likely. In the same way U{X N \S N , Z N ) = 
N - mnk(H ( £ s) ). This implies M(S N \Z N ) = rank(iJ^ ) ) - 
rank(iJf). ■ 
Fig. Q] shows the equivocation rate at Eve, and also the upper 
bound for R e as a function of e w for fixed R = 0.25 and 
e m = 0.25. It is interesting to note that even with a block 
length of only 1024 bits the curves are close to the upper 
bound. 
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